Control unit for a restraint system

ABSTRACT

A control unit for a restraint system fires all connected pyrotechnic firing elements. The control unit receives for that purpose, via an interface, a software element that configures all the firing circuits and the triggering algorithm for firing all the firing circuits, and that emulates for a safety module sensor values such that the safety module enables all the firing circuits.

BACKGROUND INFORMATION

In certain markets such as Japan, a so-called disposal firing functionis required by law in control units for restraint systems. Its purposeis safely to fire or burn off all the pyrotechnic firing and gasgeneration elements of airbags and belt tensioners when the vehicle isscrapped. The scrapping operation can then proceed without danger fromthe airbags, and without endangering the environment. In addition, theburned-off pyrotechnic elements do not require laborious disposal, butcan be recycled as scrap metal.

SUMMARY OF THE INVENTION

The control unit according to the present invention has the advantagethat a software element is fed into the control unit via analready-existing interface, preferably a diagnostic interface, of thecontrol unit; and the software element then configures all the firingcircuits and the triggering algorithm for firing all the firing circuitsand, for a safety module that checks the sensor values independently ofa processor in the control unit and then, as applicable, enables thefiring circuits as a function of the check, emulates those sensor valuesso that the safety module enables all those firing circuits. Atriggering instance for all firing circuits is thus simulated. By way ofthis software element, all the firing elements can then easily be firedwithout additional connectors by way of the hardware already present, sothat disposal firing is thus guaranteed in very simple fashion.Emulation of the sensor values is necessary because the safety pathwaycannot be accessed via the diagnostic interface. The software elementcan also be implemented so that it is merely an instruction that causesactivation in the control unit of further software that configures thetriggering algorithm and the firing circuits for firing all the firingelements that are present, and emulates the sensor values in orderultimately to fire all the firing elements.

For reasons of uniformity, it is particularly advantageous that thediagnostic interface is either a CAN bus or a K-line. The K-line(communications line) is a standardized hardware interface by way ofwhich, for example, factory or other diagnoses (shop diagnoses) can bemade. Advantageously, the processor, the safety module, and at least onesensor module and/or at least one interface module for the connection ofexternal sensors are connected via a bus, the processor emulating thesensor values on the bus so that the safety module checks those emulatedsensor values. The so-called serial peripheral interface bus (SPI bus)is advantageously used as the bus. The SPI line itself encompasses fiveindividual lines. Since a synchronous transfer is involved, a Clock line(designated CLK) is present. The Master Out Slave In (MOSI) line ispresent for data transfer from the master (in this case the processor)to a slave (e.g. a sensor IC or an interface module). The Master InSlave Out (MISO) line, on the other hand, is present for data transferfrom a slave to the master. The Chip Select (CS) line is used to selectthe corresponding slave. An Enable line (designated EN) is used toenable SPI data transfer. The SPI line proceeds from a master and thenbranches out to the individual slaves, although the SPI line always hasthe five individual lines. Provision is made in this context for theprocessor to transfer those emulated sensor values via the MISO line,through which the processor normally receives data, in order thereby tosimulate the emulated sensor values to the safety module. For thatpurpose, the MISO line is connected to an input/output port of theprocessor for transfer of the emulated sensor values.

A boot loader, which loads the software element and then immediatelystarts it, is furthermore advantageously provided in the processor. Areset switch, which is provided for restarting the at least one sensormodule and safety module, can advantageously also be provided. Thefiring circuits can also be restarted therewith.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of the control unit according to the presentinvention.

FIG. 2 is a flow chart according to the present invention.

DETAILED DESCRIPTION

A disposal firing concept by way of customer diagnostic interfacesalready present in the airbag control unit, such as CAN or K-line, withno additional interfaces, is provided. Existing mechanical andelectrical hardware is utilized. What is provided in particular in thecontext of the control unit according to the present invention is thatan independent safety pathway that is implemented by way of a safetymodule is deceived, by the emulation of such sensor values whichindicate a triggering instance for all firing elements.

The processor, which can be a microcontroller, evaluates sensor channelssuch as acceleration values and rotation rate values that are availablein particular via an SPI bus, and processes them in accordance with theimplemented algorithms. These are the algorithms which serve to activatethe restraint means that are fired via the firing elements, if they arepyrotechnically triggerable restraint means such as airbags or belttensioners. The microcontroller accesses output stage ICs, i.e. thefiring circuits, via a second (in some circumstances) SPI bus. Theoutput stage ICs monitor the firing element and ensure, in the event oftriggering, that triggering energy is conveyed to the connected firingelements.

A further IC, referred to here as the safety module, is used toimplement the hardware pathway that is independent of themicrocontroller. This safety module is connected to the same SPI bus asthe sensors and the microcontroller. The safety module can be configuredonly once after each activation of the control unit, after which nofurther write access to it can occur. The safety module monitors thesensor data transferred over the SPI bus and compares them with thestored limit values. If a sensor exceeds defined thresholds, this safetymodule then, independently of the microcontroller, delivers aplausibility signal for the triggering of specific ignition circuits.The safety module is thus made up of circuits that, in terms of theircomplexity, are much simpler than those of a microcontroller.

According to the present invention a special disposal firing softwareprogram, here described as a software element, is loaded into themicrocontroller via a diagnostic interface directly into a RAM memory,and stacked there. A so-called boot loader software program is used forthis.

The purpose of the disposal firing software program is to operate thecontrol unit using all the signals that make possible uninterruptedoperation of the control unit. This includes operating the watchdog andallowing bus communication. A further purpose is to manipulate, i.e.configure, the airbag algorithm in the microcontroller so that themicrocontroller enables triggering of all the firing circuits, and firesthem. An additional purpose is to cause the safety module to supplyplausibility for the output stage ICs.

A further constituent of such a concept can optionally be a simplecircuit, controlled by the microcontroller, for resetting the sensor andoutput-stage ICs as well as the safety module. The boot loader softwareprogram controls the reset switch. This circuit makes handling of thedisposal firing concept more flexible, since after a reset of this kind,reconfiguration is possible. This can occur independently of theinitialization phase of the control unit, at the end of which all theICs are locked and write access is thereafter impossible. The softwareelement will then emulate a virtual sensor that, via the SPI bus towhich the physical sensors and the safety module are connected, feedsemulated sensor data onto the SPI bus. Those emulated sensor data areevaluated by the safety module and cause the safety module to enable theoutput stage ICs.

FIG. 1 shows control unit 100 according to the present invention in ablock diagram. A processor 101, here embodied as a microcontroller,receives, via a transceiver (i.e. an interface module 102) and adiagnostic interface 103, the software element with which disposalfiring is performed. Diagnostic interface 103 is in this case a CAN busor a K-line, or other diagnostic interfaces suitable for the purpose.

In microcontroller 101, the software element is loaded with a bootloader software program 115 out of a RAM serving as memory, and started,so that the software element configures the algorithm for activatingoutput stages in processor 101 as well as the output stages themselves,and performs the sensor emulation. The configuration is such that allthe firing elements are activated. The algorithm will accordingly fireall the firing elements. It is possible to start the software elementusing other programs.

Processor 101 is connected via a first SPI bus 104 to a safety module105 and two sensor modules 111 and 112, and to an interface module 113to which external sensors are connected. Via a second SPI bus 109,microcontroller 101 is connected to a memory 119 that is embodied as anEEPROM, to a first output stage IC 108, and to a second output stage IC107. Processor 101 is optionally connected, via a data output, to apower switch 110 with which energy reserve voltage is switched throughto output stages 107 and 108. It is additionally possible for processor101 to perform a so-called ASIC reset 117, in which output stages 107,108 and sensor modules 111 and 112 are caused to restart. SPI bus 104 isconnected via its MISO line to an input/output port on processor 101, inorder to transfer via this actual input line, by way of processor 101,the emulated sensor values of virtual sensor 116 that is constituted bythe software element. The input line is thus used as an output line.Safety module 105 is then therefore deceived by means of the emulatedsensor values in such a way that it enables output stages 107 and 108via line 106. Microcontroller 101 will then cause firing of the firingelements via output stages 107 and 108, since the triggering algorithmon microcontroller 101 has been configured by the software element insuch a way that triggering can now occur. Safety module 105 also checksand emulates the sensor values of the sensors externally connected viainterface module 113. The RAM is associated with processor 101.

FIG. 2 illustrates what happens in control unit 100. In method step 200,the software element is loaded into processor 101 via interface 103 andtransceiver 102, and then stacked by boot loader software program 115.This then occurs in method step 201. In method step 202 the softwareelement, once constituted (started), will then configure the algorithmin processor 101, and output stages 107 and 108, in such a way thatfiring of all the firing elements can occur. This is possible, however,only if safety module 105 also enables output stages 107 and 108. Forthat purpose, sensor values that authorize a triggering of all thefiring elements are then simulated on bus 104 by the software elementvia a virtual sensor 116. Safety module 105 then enables output stages107 and 108 via line 106. Firing of the firing elements by output stages107 and 108 can then take place in method step 204. Output stage ICs 107and 108, as well as sensor modules 111 and 112 containing XY sensors,can be restarted for configuration by way of circuit 117 that isassociated with processor 101, in order to simplify the configuration ofthese modules for triggering.

1. A control unit for a restraint system for firing all connectedpyrotechnic firing elements, comprising: a safety module; and aninterface for receiving a software element which is configured such thatas a function of the software element all firing circuits, and atriggering algorithm for firing all the firing circuits, are configured,and sensor values for the safety module are emulated such that thesafety module enables all the firing circuits.
 2. The control unitaccording to claim 1, wherein the interface is a CAN bus.
 3. The controlunit according to claim 1, wherein the interface is a K-line.
 4. Thecontrol unit according to claim 1, further comprising: a bus; and aprocessor connected via the bus to the safety module and to at least oneof (a) at least one sensor module and (b) at least one interface modulefor a connection of at least one external sensor, the processoremulating sensor values on the bus.
 5. The control unit according toclaim 4, wherein the bus is a serial peripheral interface bus, theprocessor being the master and being configured in that the processortransfers the emulated sensor values via a MISO line.
 6. The controlunit according to claim 5, wherein the MISO line is connected to an I/Oport of the processor for transfer of the sensor values.
 7. The controlunit according to claim 4, wherein the processor contains a boot loadersoftware program that loads and starts the software element.
 8. Thecontrol unit according to claim 4, further comprising at least one resetswitch for restarting the at least one sensor module, the safety moduleand the firing circuits.